CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-55086

Etherpad (ep_etherpad-lite) versions prior to 3.1.0 are vulnerable to a symlink-based file overwrite via predictable temporary filenames. The ImportHandler.ts and ExportHandler.ts components derive temp-file paths from Math.random() (~32 bits of entropy), which is predictable within the same Node...

EUVD-2026-62721

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control...

CVE-2026-55087 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control...

CVE-2026-55087 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

EUVD-2026-42309

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted...

GHSA-9GMC-JQMH-3RVM Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

GHSA-RR55-JP92-8WP2 claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

GHSA-CC2G-GQ8C-R332 grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2025-14600

vsDesk, a PHP/Yii2 helpdesk application, contains an insecure deserialization flaw (titled as path traversal) enabling unauthenticated remote attackers to manipulate configuration data, redirect LDAP authentication to an attacker-controlled server, and provision a new admin account. CVSS 4.0 scor...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...